• Resolved Aaron

    (@ergate)


    I have a site that is powered by wordpress 1.5.2 and it was recently hacked the root level of the install now reads “spykids ownz you”. I dont think this was a security issue with WordPress, I am working with the admins of the server and we are trying to isolate what allowed the penetration. I can log into the admin section with no problem, none of the entries, users or passwords are affected.

    If you have heard of this with a WP site please let me know. I will post back anything that we find out.

    Aaron

Viewing 4 replies - 16 through 19 (of 19 total)
  • Got what ?

    Got the spykids “hack”…what do you do to get rid of it. All of my themes are totally screwed up, tried to reload them, to no avail.

    Upgrade to 1.5.2 – unless the blog at https://www.whohadada.com/blog/index.php is yours as that is already at 1.5.2

    There are no known security holes in 1.5.2, and from other reports it does not seem that WP is the weakness, rather that something else on the server has been exploited.
    If yoy have any server logs to the contrary, we would love to see them ?

    Thread Starter Aaron

    (@ergate)

    Sorry for the delay in response, and sorry for the spykidz.

    Again, WP was not exploited. The server was exploited through a weakenss in an install of PHPBB, by someone on a different domain (the joys of shared hosting).
    I do not know what weakness they exploited, but I know the result, which is index files were over written with the irritating tag line. As a side note, I have several different installs of WP on one shared server (all installed at different domains). Only one theme in one install was affected, and it was only affected becuase I had the permissions set to 666, I was editing the file through the file editor, this is the only reason that we (my host admins and I) can find that allowed the index file to be overwritten.

    The only steps that I needed to to fix the problem was to refresh my theme from a “unaffected” backup. And make sure that I reset permissions as soon as I am done working. I keep and make my own backups, so this was no problem. As an added precaution, and as a way to clean up the domain, I asked the Hosting Provider admin to delete all contents from the httpdocs, and I started the whole thing fresh.

    The Database was not affected so it did not need any work.

Viewing 4 replies - 16 through 19 (of 19 total)
  • The topic ‘site hacked’ is closed to new replies.